Nowhere in the article does it say that the POST data was in the URL. As I understood it, he was editing the request body before the request was sent to PayPal's server.

The URL is encrypted too, so what's the difference in terms of security?

Does it matter in this case?